Healthcare Analytics Policy & Compliance Flashcards

A health system's analytics team creates a population health dashboard using aggregated claims data. Under HIPAA, this data requires privacy protections if:

Answer: The dataset can be re-linked to individuals using reasonably available information

Even aggregated data may constitute PHI if it is possible to re-identify individuals using other reasonably available information, failing the Expert Determination de-identification standard.

The OIG Work Plan signals enforcement priorities. Healthcare analytics programs should monitor it primarily to:

Answer: Identify billing practices and data areas subject to heightened audit and compliance scrutiny

The OIG Work Plan outlines planned audits and investigations, allowing organizations to proactively assess their compliance posture in areas the OIG deems high-risk.

Under 21st Century Cures Act provisions, patients have the right to access their Electronic Health Information (EHI) through certified APIs. Healthcare systems must provide this access:

Answer: Without special effort (i.e., charges for standard API access are prohibited as information blocking)

The 21st Century Cures Act and ONC's Information Blocking Rule require that access to EHI via certified APIs be provided without special effort or fees that would constitute information blocking.

A healthcare organization's compliance officer discovers that a predictive analytics model used for care management has a statistically significant racial bias in its risk scores. The primary compliance concern involves:

Answer: Civil rights obligations under Section 1557 of the ACA prohibiting discrimination in health programs

Section 1557 of the ACA prohibits discrimination on the basis of race in health programs receiving federal funding, and algorithmic bias that leads to differential treatment may constitute a civil rights violation.

CMS's Interoperability and Patient Access Final Rule requires payers to implement FHIR-based APIs. The primary analytics compliance implication is:

Answer: Organizations must enable patient data portability and cannot block data flows that meet FHIR R4 standards

The CMS Interoperability Rule requires payers to make patient data accessible via HL7 FHIR R4 APIs; blocking compliant data access constitutes information blocking under ONC rules.

Under HIPAA, a covered entity that discovers a workforce member inappropriately accessed 50 patient records out of curiosity (snooping) is required to:

Answer: Treat the access as a presumed breach and conduct a four-factor risk assessment to determine if notification is required

Under the HIPAA Breach Notification Rule, any unauthorized access is presumed a reportable breach unless a four-factor risk assessment demonstrates low probability of PHI compromise.

The Trusted Exchange Framework and Common Agreement (TEFCA) is designed to:

Answer: Establish a universal baseline for nationwide health information exchange through a single on-ramp model

TEFCA creates a voluntary, nationwide framework that enables any-to-any health information exchange through Qualified Health Information Networks (QHINs) without replacing existing HIE infrastructure.